PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-50148 Siemens CVE debrief

This CVE addresses a wild-memory-access vulnerability in the Linux kernel's Bluetooth BNEP (Bluetooth Network Encapsulation Protocol) subsystem. The issue stems from improper error handling in the bnep_init() function, which ignores the return value of bnep_sock_init(). When bnep_sock_init() fails and cleans up its resources, subsequent module removal triggers bnep_sock_cleanup() to access already-freed memory, leading to a use-after-free condition. The vulnerability is classified as MEDIUM severity with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), indicating local attack vector with low attack complexity and privileges required, resulting in high availability impact. The vulnerability was published on 2024-04-09 and last modified on 2026-05-14. Siemens has identified this as affecting the GNU/Linux subsystem of SIMATIC S7-1500 TM MFP industrial control devices. No patch is currently available from the vendor.

Vendor
Siemens
Product
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2026-05-14
Advisory published
2024-04-09
Advisory updated
2026-05-14

Who should care

Organizations operating Siemens SIMATIC S7-1500 TM MFP industrial control systems with the GNU/Linux subsystem enabled, OT security teams managing Bluetooth-capable industrial devices, and Linux kernel maintainers supporting Bluetooth networking stacks in embedded industrial environments.

Technical summary

The vulnerability exists in the Bluetooth BNEP protocol implementation within the Linux kernel. The bnep_init() function fails to check the return value of bnep_sock_init(), which can fail and perform resource cleanup. When the BNEP module is subsequently removed, bnep_sock_cleanup() attempts to clean up socket resources that have already been freed, resulting in wild memory access. The fix involves properly propagating bnep_sock_init()'s return value through bnep_exit() to prevent the cleanup sequence from executing on failed initialization. This is a local vulnerability requiring low privileges, with exploitation leading to denial of service through system crash.

Defensive priority

medium

Recommended defensive actions

  • Restrict interactive shell access to the GNU/Linux subsystem on affected Siemens SIMATIC S7-1500 TM MFP devices to trusted personnel only
  • Implement application whitelisting to ensure only trusted applications are built and executed on the GNU/Linux subsystem
  • Monitor for anomalous Bluetooth module loading/unloading activity on affected systems
  • Apply vendor patches when released by Siemens
  • Review and implement CISA ICS recommended practices for defense-in-depth strategies

Evidence notes

Vulnerability description sourced from CISA CSAF advisory ICSA-24-102-01 and Siemens security advisory SSA-265688. CVSS vector confirmed as CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Affected product identified through CSAF product tree as SIMATIC S7-1500 TM MFP - GNU/Linux subsystem. Remediation status confirmed as 'none_available' in source advisory.

Official resources

2024-04-09